Of course there is one possibility why a process would not show up with the standard tools, but still be present. If your system has a rootkit, then processes could be running that would occasional appear to be invisible, and the standard tools may display unusual results.
–
ZoredacheNov 30 '11 at 21:35

I thought of rootkit as well, but rpcinfo -p gave me the process name associated with it. So, I removed the idea that it could be a rootkit.
–
CarmenNov 30 '11 at 21:52

You have to execute netstat -tulnp as root. Otherwise you get the - instead of the process name.

This is what the manpage says:

PID/Program name
Slash-separated pair of the process id (PID) and process name of the process that owns the socket. --program causes this column
to be included. You will also need superuser privileges to see this information on sockets you don't own. This identification
information is not yet available for IPX sockets.

I did execute all of the commands as root.
–
CarmenNov 30 '11 at 21:28

After googling around, nlockmgr uses IPX socket which is why netstat could not identify the process. Thanks. But if netstat cannot detect process associated with IPx, what program can do it?
–
CarmenNov 30 '11 at 21:41